domains / families / security / analyzing-windows-lnk-files-for-artifacts

analyzing-windows-lnk-files-for-artifacts

separate

Parse Windows LNK shortcut files to extract target paths, MAC timestamps,

When to use

• When reconstructing user file access history from Windows shortcut files
• For tracking accessed files, network shares, and removable media
• During investigations to prove a user opened specific documents
• When correlating file access with other timeline artifacts
• For identifying accessed paths on remote systems or USB devices

Skill page

Source